# terraform-dynamodb

## Overview

This is a module to create aws dynamo db tables with autoscaling.

### Variables

There are two variables that must be provided for the module to function properly:
```
    - variable "env"
    - variable "table_name"
```

The following variable has to be changed since they manage the primary key of the dynamodb table:
```
    - variable "hash_key"          - Name of primary key
```

Set the value of range_key_enabled to 'true' to create a dynamodb table with sort key, and leave unset if not.
```
    - variable "range_key_enabled" - (Set to 'true' or 'false' to set a sort key in your table)
    - variable "range_key"         - Name of sort key
    - variable "range_type"        - (Possible values: 'S' for String, 'B' for Boolean, 'N' for Numeric)
```

Set variable type mappings
```
    - variable "attribute"          - List of name to type mappings
```

Consult the variable definition file for additional options, which can be optionally overridden:
```
    - variable "max_read_capacity"
    - variable "min_read_capacity"
    - variable "max_write_capacity"
    - variable "min_write_capacity"
    - variable "read_capacity_utilization_percentage"
    - variable "write_capacity_utilization_percentage"
```

By default, server side encryption is enabled, meaning that AWS managed KMS customer master key will be used. If you want to use a custom AWS KMS key you can specify it using `kms_key_arn` variable. 

In the server-side encryption configuration, `kms_key_arn` must not be specified if the default AWS KMS key is used. Source: https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_SSESpecification.html

The following outputs are provided by the module for consumption in other terraform code:
```
    Provided with primary key only:
      - aws_dynamodb_table_arn
      - aws_dynamodb_table_id
      - aws_dynamodb_stream_arn

    Provided with primary and sort key:
      - aws_dynamodb_table_arn_with_sort_key
      - aws_dynamodb_table_id_with_sort_key
      - aws_dynamodb_table_stream_arn_with_sort_key
```

### Resources

#### The module manages the following:

* Creating the dynamodb table
    - Primary key
    - Sort key
* Configures autoscaling for the dynamodb table

### Sample main.tf
```hcl
variable env {}

provider "aws" {
  region = "us-east-1"
}

module "dynamodb_table" {
  source = "git@github.com:theorchard/terraform-dynamodb.git//?ref=x.y.z"

  env        = var.env
  table_name = "table_name"
  hash_key   = "hash_key_name"

  attribute = [
    {
      name = "hash_key_name"
      type = "N"
    },
  ]
}
```

### Sample main.tf with sort key enabled
```hcl
variable env {}

provider "aws" {
  region = "us-east-1"
}

module "dynamodb_table" {
  source = "git@github.com:theorchard/terraform-dynamodb.git//?ref=x.y.z"

  env               = var.env
  table_name        = "table_name"
  range_key_enabled = true
  hash_key          = "hash_key_name"
  range_key         = "range_key_name"

  attribute = [
    {
      name = "hash_key_name"
      type = "N"
    },
    {
      name = "range_key_name"
      type = "S"
    },
  ]
}
```

```hcl
variable env {}

provider "aws" {
  region = "us-east-1"
}

data "aws_iam_policy_document" "customer_managed_kms_policy_example" {
  version = "2012-10-17"
  statement {
    sid    = "Allow access through Amazon DynamoDB for all principals in the account that are authorized to use Amazon DynamoDB"
    effect = "Allow"
    principals {
      identifiers = ["arn:aws:iam::111122223333:user/db-lead"]
      type        = "AWS"
    }
    actions = [
      "kms:Encrypt",
      "kms:Decrypt",
      "kms:ReEncrypt*",
      "kms:GenerateDataKey*",
      "kms:DescribeKey",
      "kms:CreateGrant"
    ]
    resources = ["*"]
    condition {
      test     = "StringLike"
      values   = ["dynamodb.*.amazonaws.com"]
      variable = "kms:ViaService"
    }
  }

  statement {
    sid    = "Allow administrators to view the KMS key and revoke grants"
    effect = "Allow"
    principals {
      identifiers = ["arn:aws:iam::111122223333:role/db-team"]
      type        = "AWS"
    }
    actions = [
      "kms:Describe*",
      "kms:Get*",
      "kms:List*",
      "kms:RevokeGrant"
    ]
    resources = ["*"]
  }
}

resource "aws_kms_key" "dynamodb_table_custom_kms_key" {
  description             = "My KMS key for DynamoDB"
}

resource "aws_kms_key_policy" "dynamodb_table_custom_kms_key_policy" {
  key_id = aws_kms_key.dynamodb_table_custom_kms_key.id
  policy = data.aws_iam_policy_document.customer_managed_kms_policy_example.json
}

module "dynamodb_table" {
  source = "git@github.com:theorchard/terraform-dynamodb.git//?ref=x.y.z"

  env               = var.env
  table_name        = "table_name"
  range_key_enabled = true
  hash_key          = "hash_key_name"
  range_key         = "range_key_name"
  
  kms_key_arn = aws_kms_key.dynamodb_table_custom_kms_key.arn

  attribute = [
    {
      name = "hash_key_name"
      type = "N"
    },
    {
      name = "range_key_name"
      type = "S"
    },
  ]
}
```

Check the latest version on the [Releases Page][1]


[1]: <https://github.com/theorchard/terraform-dynamodb/releases> "terraform-dynamodb releases page"